/**
 * manifest-refresh.ts — D14 --force-refresh-manifests flag implementation.
 *
 * Phase 1b C2 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
 * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
 *
 * Decisions consumed:
 *   D14 — --force-refresh-manifests flag (NOT a subcommand); requires
 *          --accept-security-regression when security-sensitive fields differ.
 *
 * Security-sensitive manifest fields (refuse without --accept-security-regression):
 *   - securityContext (pod or container level)
 *   - resources.limits
 *   - capabilities (add/drop lists)
 *   - readOnlyRootFilesystem
 *   - RBAC Role rules (rules[].verbs / resources / apiGroups)
 *
 * Audit log:
 *   ~/.olam/state/manifest-refresh-audit.jsonl (mode 0600; append-only)
 *   ENOSPC aborts the refresh with "audit log unavailable: <error>".
 *   The file is created on first write; mode set via writeFileSync options.
 *
 * Two functions are exported:
 *   diffManifestSecurityFields — pure diff, no I/O; testable.
 *   runManifestRefresh         — performs the full refresh with audit-log.
 */
import * as fs from 'node:fs';
export declare const MANIFEST_REFRESH_AUDIT_LOG: string;
/** Security-sensitive field paths checked by the diff. */
export declare const SECURITY_SENSITIVE_FIELDS: readonly ["securityContext", "resources.limits", "capabilities", "readOnlyRootFilesystem", "rules"];
export type SecuritySensitiveField = (typeof SECURITY_SENSITIVE_FIELDS)[number];
export interface ManifestDiffResult {
    /** True when any security-sensitive field value differs between old and new. */
    hasSecurityRegression: boolean;
    /** List of field keys that changed. */
    changedFields: SecuritySensitiveField[];
}
export interface ManifestRefreshAuditEntry {
    ts: string;
    manifests_path: string;
    security_regression: boolean;
    changed_fields: string[];
    accepted: boolean;
    operator_pid: number;
    /** When set, the refresh was scoped to this peripheral's manifest subdir (C4/D19). */
    peripheral?: string;
}
export interface ManifestRefreshDeps {
    /** Override state dir for tests. */
    readonly stateDir?: string;
    /** Override manifests dir for tests. */
    readonly manifestsDir?: string;
    /** Override audit log path for tests. */
    readonly auditLogPath?: string;
    /** Override fs.readdirSync for tests. */
    readonly readdirSync?: typeof fs.readdirSync;
    /** Override fs.readFileSync for tests. */
    readonly readFileSync?: typeof fs.readFileSync;
    /** Override fs.writeFileSync for tests. */
    readonly writeFileSync?: typeof fs.writeFileSync;
    /** Override fs.existsSync for tests. */
    readonly existsSync?: typeof fs.existsSync;
    /** Override Date.now for tests. */
    readonly now?: () => Date;
}
export interface SeedManifestsDeps {
    /** Override installRoot path (for tests). */
    readonly installRootDir?: string;
    /** Override target manifests dir path (for tests). */
    readonly targetManifestsDir?: string;
    /** Override fs.existsSync (for tests). */
    readonly existsSync?: typeof fs.existsSync;
    /** Override fs.cpSync (for tests). */
    readonly cpSync?: typeof fs.cpSync;
    /** Override fs.mkdirSync (for tests). */
    readonly mkdirSync?: typeof fs.mkdirSync;
}
export type SeedManifestsResult = {
    seeded: true;
    source: string;
    target: string;
    message: string;
} | {
    seeded: false;
    skipped: true;
    reason: string;
} | {
    seeded: false;
    skipped: false;
    error: string;
};
/**
 * Copy bundled manifests from the CLI package's host-cp/k8s/manifests/ to
 * ~/.olam/k8s/manifests/ if the target dir does not yet exist.
 *
 * @param forceRefresh — when true, always overwrite (--force-refresh-manifests path).
 * @param deps         — injectable for tests.
 */
export declare function seedManifestsFromBundle(forceRefresh: boolean, deps?: SeedManifestsDeps): SeedManifestsResult;
/**
 * Pure diff between two YAML manifest file contents (as strings).
 * Parses each as JSON (manifests may be JSON or YAML; we handle JSON
 * and treat parse failures as "content changed" = regression to be safe).
 *
 * Used by runManifestRefresh and directly by tests.
 */
export declare function diffManifestSecurityFields(oldContent: string, newContent: string): ManifestDiffResult;
export type ManifestRefreshResult = {
    ok: true;
    message: string;
} | {
    ok: false;
    message: string;
};
/**
 * Run the manifest refresh check.
 *
 * @param manifestsDir    — path to ~/.olam/k8s/manifests/
 * @param acceptRegression — true when --accept-security-regression is set
 * @param deps            — injectable for tests
 * @param peripheral      — when set, scope diff to manifests/<peripheral>/ ONLY (C4/D19)
 *
 * Returns ok=false when:
 *   - Security-sensitive fields differ AND !acceptRegression.
 *   - Audit log write fails (ENOSPC).
 *   - peripheral is set but the peripheral subdir does not exist.
 *
 * On ok=true the audit log entry is written with accepted=true (or
 * accepted=false when no regression was detected — regression-free
 * refreshes are still audited).
 *
 * When peripheral is set, the audit-log entry includes { peripheral: <name> } (D19).
 * Other peripherals' security drift does NOT block a targeted peripheral refresh (D19).
 */
export declare function runManifestRefresh(manifestsDir: string, acceptRegression: boolean, deps?: ManifestRefreshDeps, peripheral?: string): Promise<ManifestRefreshResult>;
//# sourceMappingURL=manifest-refresh.d.ts.map